|search colomn1!=0 worked for me | multisearch [ search index=foo sourcetype=bar earliest=-0d@d latest=now | eval label="Colomn1" | fields -_raw _time apple label ] [ search index=foo sourcetype=bar earliest=-7d@d latest=-7d@d | eval _time=_time+60*60*24*7 | eval label="Colomn2" | fields -_raw _time apple label ] [ search index=foo sourcetype=bar earliest=-14d@d latest=-14d@d | eval _time=_time+60*60*24*14 | eval label="Colomn3" | fields -_raw _time apple label ] [ search index=foo sourcetype=bar earliest=-21@d latest=-21@d | eval _time=_time+60*60*24*21 | eval label="Colomn4" | fields -_raw _time apple label ] [ search index=foo sourcetype=bar earliest=-28@d latest=-28@d | eval _time=_time+60*60*24*28 | eval label="Colomn5" | fields -_raw _time apple label] | bin _time span=5m | chart dc(apple) over _time by label | eval "Colomn1 4 Week Avg"=('Colomn2'+Colomn3+Colomn4+Colomn5)/4 | eval "Colomn2 4 Week Avg"=abs('Colomn2'-'Colomn1') | eval "Diff of Colomn1 and 4 Week Avg."=abs('Colomn5'-'Colomn1') | eval Est_Impact= abs('Diff of Colomn1 and Colomn2'-'Colomn5.') | fields _time "Colomn1" "Colomn2" "Colomn3" "Colomn4" "Colomn5" |search colomn1!=0 ... View more

try this: index=<your_index> |rex "(\d|\w)\d{3}_\d{3}01(?<EventId>\d{4})" also, try this run anywhere search: | makeresults | eval data="054100172.23.47.142 20191025183818S617_0310120060387212200090541SEG_EAltaSesOpe 0000000000000000000000000000JR388400000000000 C200-025C96D22DA|1010000000D9,999900 20191025183334S617_0310130020571272600120541ConsultaLDAP 0000000000000000000000000000JB146000000000001 149029 3C0CFF0F|0000000000D9" | makemv data delim="," | mvexpand data | rex field=data "(\d|\w)\d{3}_\d{3}01(?<EventId>\d{4})" ... View more